Author: Weirong Jiang and Viktor K. Prasanna Publisher: ACM Symposium on Parallel Algorithms and Architectures, SPAA 2009 Presenter: Chin-Chung Pan Date: 2009/10/14

Outline Introduction Analysis of Snort Header Rule Sets Algorithms and Architecture The Field-Split Bit Vector (FSBV) Algorithm Basic Architecture Supporting Snort Features Performance Evaluation 2

Introduction Traditional network applications such as firewall processing require reporting only the highest-priority matching rule, which we call best-match packet classification. In contrast, network intrusion detection systems ( NIDS) needs multi-match packet classification to find all rule headers that match a given packet. Our work focuses on the multi-match packet header classification in NIDS. 3

Analysis of Snort Header Rule Sets 4

Algorithms and Architecture 5

Algorithms and Architecture - The Field-Split Bit Vector (FSBV) Algorithm Applying the FSBV algorithm for matching the DP field of a packet against three rules. 6

Algorithms and Architecture - Basic Architecture 7

Algorithms and Architecture - Supporting Snort Features We examined the usage of those unique features provided by Snort rules, including the value list, the negation operator, and the range operator for port fields. The negation operator “!”. For example, ![60,80] indicates any port number except 60 and 80. The range operator. For example, 60:80 indicates port number from 60 to 80. 8

Algorithms and Architecture - Supporting Snort Features 9

10 Other File DP(4-bit)Rule R1 R2 R3 R4 … … … … 11* * 0111 、 100* Range 12 、 、 13 7~9 R1R2R3R4R’ & & & DP of the input packet: Rule Set Build bit vectors Perform match 1010 OR

Algorithms and Architecture - Supporting Snort Features 11 In N rules, a field of the ith rule is specified as a list of M values, the ith bit of all bit vectors for this field is expanded to M bits. N+M-1 bits N bits N+M-1 bits

Algorithms and Architecture - Supporting Snort Features Most of port fields are specified as a single value. Over 85% of the unique values for SP/DP fields are specified as a single value, while only around 10% of port field values are specified as ranges. Current Snort rule set uses few value lists. 12

Performance Evaluation - Results on Synthetic Rules 13

Performance Evaluation - Results on Snort Rules 14